+-- On Mon, 24 Apr 2017, P J P wrote --+
| While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
| an off-by-one error could occur as 's->adp_reset' index is not
| reset after reading the last sequence.
|
| --- a/hw/scsi/megasas.c
| +++ b/hw/scsi/megasas.c
| @@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr
addr,
| case MFI_SEQ:
| trace_megasas_mmio_writel("MFI_SEQ", val);
| /* Magic sequence to start ADP reset */
| - if (adp_reset_seq[s->adp_reset] == val) {
| - s->adp_reset++;
| + if (adp_reset_seq[s->adp_reset++] == val) {
| + if (s->adp_reset == 6) {
| + s->adp_reset = 0;
| + s->diag = MFI_DIAG_WRITE_ENABLE;
| + }
| } else {
| s->adp_reset = 0;
| s->diag = 0;
| }
| - if (s->adp_reset == 6) {
| - s->diag = MFI_DIAG_WRITE_ENABLE;
| - }
| break;
Ping...!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
